chore(consistency): sync task status from DB [auto]

Updated by fix-consistency on 2026-09-08:
  - update .custodian-brief.md for ops-warden

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

.custodian-brief.md

@@ -2,7 +2,7 @@
 # Custodian Brief — ops-warden
 
 **Domain:** infotech  
-**Last synced:** 2026-09-08 12:57 UTC  
+**Last synced:** 2026-09-08 18:23 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -25,6 +25,13 @@ Progress: 2/3 done  |  workplan_id: `42a097db-1c24-558e-a724-030bb2b4443e`
 **Open tasks:**
 - ! Prove routing and publication  `a8b1b855`
 
+### Preserve explicit policy caller refusals before credential and CA effects
+Progress: 2/3 done  |  workplan_id: `ae44a935-6fca-514c-a385-4550dd2b1fe8`
+
+**Open tasks:**
+- ! Resolve the credential proxy's admitted policy binding  `8ca28b63`
+  *(wait: The configured ops-warden caller represents ops-warden; credential requests name their owner as resource.system. Need the flex-auth/credential-owner contract for that exact delegated read, without broadening caller bindings or relabelling resource ownership.)*
+
 ## Inbox Hygiene
 
 **Missing thread_id:** 4 unread message(s) lack supersession chains.